NIS2 deadlines: the dates for companies in Germany and the EU
In Germany, NIS2 has applied since 6 December 2025 through the BSI Act (BSIG). The duties run from that day. You must register at the latest three months after your company comes into scope; for companies in scope since December 2025 that was 6 March 2026. You report a significant incident within 24 hours.
The deadlines for your company
These deadlines are in the BSIG. Some run from a date, some from an event.
6 December 2025
The new BSIG enters into force. From this day the duties apply to companies in scope.
BGBl. 2025 I no. 301
3 months after coming into scope
Registration with the BSI. In scope since 6 December 2025: by 6 March 2026.
§ 33(1) BSIG
2 weeks after a change
Update changed registration details in the BSI portal, such as a new address.
§ 33(5) BSIG
24 hours, 72 hours, 1 month
Significant security incident: early warning within 24 hours and incident notification within 72 hours of becoming aware, final report one month after the notification.
§ 32(1) BSIG
Regularly
Training of management. The explanatory memorandum reads this as training offered at least every three years.
§ 38(3) BSIG
6 December 2028 at the earliest
The BSI can ask essential entities for evidence. For approved hospitals, from 6 December 2030 at the earliest.
§ 61(3) BSIG
Every 3 years
Operators of critical facilities prove their measures to the BSI, the first time on a date the BSI sets.
§ 39(1) BSIG
The EU dates
The directive is addressed to the member states. Its dates reach companies only through their country's law.
16 January 2023
Directive (EU) 2022/2555 enters into force.
Art. 45 NIS 2
17 October 2024
By this date all member states should have transposed the directive into their law. Many, Germany among them, were later.
Art. 41(1) NIS 2
17 April 2025
The member states draw up a list of essential and important entities.
Art. 3(3) NIS 2
17 October 2027
The Commission reviews the directive, then every 36 months.
Art. 40 NIS 2
What this means for a company with 50 to 150 employees
Most deadlines do not run from a date but from an event: an incident, a change, the day your company comes into scope. What matters, then, is that someone knows what to do when it happens.
If your company only comes into scope later, for example because it grows to 50 employees, the three months for registration start on that day.
§ 33(1) BSIG
An example
A made-up company: a food manufacturer with 120 employees. It has been an important entity since 6 December 2025.
On 2 March 2026 it registers in the BSI portal, four days before the deadline.
On 10 June the contact person leaves the company. By 24 June it enters the new contact person in the portal.
Monday, 8 a.m.: order intake fails after an attack. The early warning must reach the BSI by Tuesday, 8 a.m., the incident notification by Thursday, 8 a.m.
The managing director attended training in May 2026. On the explanatory memorandum's reading, the next one is due by 2029 at the latest.
How the walkthrough does this
The walkthrough at nisd2.eu records which duties remain after implementation and which deadlines belong to them.
After approval, one page shows what stays with you: what to do in an incident, with the deadlines, and what recurs.
Each duty is listed there with its legal basis, for example § 32(1) BSIG for the reporting deadlines.
The registration step records the date of registration.
The training step records the latest training of each member of management.
Common questions
When does NIS2 apply in Germany?
Since 6 December 2025. The new BSI Act entered into force on that day. Since then the duties apply to every company that is an essential or important entity.
Is there a transition period?
Not for the measures, reporting or registration. Only some supervisory dates come later: the BSI can ask essential entities for evidence from 6 December 2028 at the earliest (§ 61(3) BSIG).
We missed the registration deadline. What now?
Register now. The duty remains even though the deadline has passed.
How long do I have to report an incident?
The early warning must reach the BSI at the latest 24 hours after you became aware of a significant incident, the incident notification at the latest after 72 hours. The final report follows one month after the notification (§ 32(1) BSIG).
All NIS2 news, updated as it happens
New laws, guidance and dates from the EU and Germany, each with its source.
2026
Austria: NISG 2026 in force, the Bundesamt fuer Cybersicherheit starts work and registration opens in NIS2 Services
The NISG 2026 (BGBl. I Nr. 94/2025), Austria's NIS 2 transposition, entered into force on 1 October 2026, and the Interior Ministry confirmed the same day that the new Bundesamt fuer Cybersicherheit has taken up work under its director Markus Kasinger. Essential and important entities and providers of domain name registration services register through the NIS2 Services application in the Unternehmensserviceportal within three months of entry into force. The authority gives 1 January 2027 as the nominal date and 4 January 2027 as the latest date, because section 33(2) AVG moves the end of a deadline that falls on a public holiday or weekend to the next working day. Public administration bodies get a connection through the Portalverbund shortly after 1 October 2026. These are national deadlines under Austrian law.
Austria: NISV 2026 extends the CIR 2024/2690 measures to every entity type and sets thresholds for significant incidents
The Austrian cybersecurity authority issued the Netz- und Informationssystemsicherheits-Verordnung (NISV 2026, BGBl. II Nr. 290/2026) on 1 October 2026 under sections 32(5) and 35(3) NISG 2026; it enters into force at the end of the day of publication. Section 2 applies the requirements of Article 2 and the Annex of Implementing Regulation (EU) 2024/2690 to every type of essential and important entity listed in Annexes 1 and 2 NISG 2026, not only to the digital providers the CIR itself covers. Entities that cannot meet a requirement temporarily or because of their size must implement documented compensating measures and review them at least once a year. An incident is significant in any case if, among other criteria, it causes or can cause a direct financial loss above EUR 500,000 or 5 percent of annual turnover, whichever is lower, an outage for more than 100,000 users or 10 percent of users, whichever is lower, for more than 24 hours, or an outage across at least one Bundesland for more than 24 hours. Repeated incidents count as one significant incident if they occur at least twice in six months with the same apparent cause and together cross the loss threshold. This is binding national law.
Latvia: Cabinet Regulation No. 602 sets where essential and important entities may host their information systems
Cabinet Regulation No. 602 on information system placement and data centre security requirements, adopted on 29 September 2026 under Article 30(2) of the National Cybersecurity Law and published in Latvijas Vēstnesis on 1 October 2026, entered into force on 1 October 2026. Unless it provides otherwise, an entity places information systems only in data centres in NATO, EU or EFTA member states or in one of NATO's Indo-Pacific partner countries, and data processing has to take place in those territories. From entry into force no new class A system may be placed in a way that does not meet the regulation. Entities with existing class A placements notify them by 31 December 2026; a non-compliant existing placement may continue until 31 December 2027 if its risks are managed and a compliance plan is prepared by 31 December 2026. This is binding national law.
Sweden: regulations on security measures, management training, audits and scanning enter into force
Two regulations under the Swedish Cybersecurity Act (cybersäkerhetslagen, SFS 2025:1506), decided by the Myndigheten för civilt försvar on 15 June 2026 and published on 18 June 2026, entered into force on 1 October 2026. MCFFS 2026:11 sets out the security measures and the management training required by chapter 2, sections 3 and 4 of the act; operators that work only in digital infrastructure, digital providers, ICT service management between businesses, postal and courier services or space are bound only by its management training requirement. MCFFS 2026:12 covers security audits and security scanning under chapter 3, sections 5 to 7. The NCSC at the FRA announced the entry into force and says comprehensive guidance on the regulations will follow around the turn of the year 2026/2027. Both are binding agency regulations.
Bulgaria: Commission closes the infringement procedure for late NIS 2 transposition
Bulgaria's Ministry of Innovation and Digital Transformation reported on 1 October 2026 that it had been notified that day that the European Commission closed infringement procedure No. 2024/0257, opened for failure to notify full transposition of Directive (EU) 2022/2555. The closure follows the amendments to the Cybersecurity Act and Bulgaria's notification of full transposition to the Commission on 6 March 2026. The Commission's own infringement register could not be checked for this entry, so the source is the ministry's announcement.
Luxembourg: authorities publish joint operational rulebooks for handling cyber incidents
On 28 September 2026 the HCPN (as ANSSI and GOVCERT.LU), CIRCL, the CSSF and the ILR published Operational guidance for incident handling under Article 14(5) of the Loi du 5 mai 2026, Luxembourg's NIS 2 transposition. It consists of rulebooks for typical incident types, published on GitHub. The guidance is not binding and states that it does not address legal obligations such as notifying incidents to the CSSF, the ILR or the CNPD.
Slovenia: about 800 essential and important entities have self-registered under ZInfV-1
Niko Gamulin, acting director of URSIV, the Government Information Security Office, said in a government news item of 25 September 2026 that about 800 essential and important entities from the public and private sectors have completed self-registration in Slovenia under ZInfV-1, the national NIS 2 transposition. URSIV is also building an online platform for registering obliged entities, reporting significant incidents and sharing information on cyber threats and risks. The figure is the authority's own count.
European Parliament: ITRE rapporteur tables draft reports on the NIS 2 targeted amendments and the Cybersecurity Act 2
Markéta Gregorová (Greens/EFA), rapporteur in the Industry, Research and Energy committee (ITRE), tabled the draft report on the proposal amending Directive (EU) 2022/2555 as regards simplification measures and alignment with the Cybersecurity Act 2, procedure 2026/0012(COD), dated 24 September 2026 (PE792.221). The draft report on the Cybersecurity Act 2 itself, procedure 2026/0011(COD), is dated 18 September 2026 (PE792.222). The deadline for committee amendments on both files is 13 October 2026, and IMCO gives an opinion on both. These are a rapporteur's drafts, not the position of the committee or of Parliament: the NIS 2 Directive applies unchanged until an amending directive is adopted, published and transposed.
BSI awards the first certificate for a secure software development process under TR-03185
The BSI announced on 23 September 2026 that DUX Healthcare GmbH of Karlsruhe received the first certificate under Technical Guideline TR-03185, which covers the secure software lifecycle from requirements analysis through maintenance and vulnerability management. Certified manufacturers can supply updates for certified products under defined conditions without a fresh product review each time. TR-03185 is a voluntary BSI certification scheme rather than a duty under the BSIG, and the announcement does not tie it to NIS 2 or to the Cyber Resilience Act.
ENISA publishes the Threat Landscape 2026 covering incidents observed during 2025
ENISA published its annual threat report on 22 September 2026, analysing incidents and events observed from 1 January to 31 December 2025. The agency concludes that cyber dependencies widen the attack surface and reports that public administrations in the EU were increasingly hit by hacktivist denial of service activity. The report is a situational assessment, not binding guidance, and creates no obligations of its own under the NIS 2 Directive.
France: the NIS 2 transposition bill goes on the Assemblee nationale floor agenda for 7 October 2026
The Conference des presidents of the Assemblee nationale fixed the autumn agenda on 22 September 2026 and scheduled the projet de loi relatif a la resilience des infrastructures critiques et au renforcement de la cybersecurite for public session on 7 October 2026, with debate continuing on 9 October. The official legislative dossier now carries that date. This is the first floor slot since the Senat adopted the bill on 12 March 2025 and the special committee reported on 10 September 2025, and it follows the Commission referral of France to the CJEU on 8 July 2026 for non transposition. A scheduled slot is not an adoption, and the examination of this bill has been postponed several times.
Austria: the new Bundesamt fuer Cybersicherheit takes up work on 1 October 2026
The Austrian Federal Ministry of the Interior announced on 22 September 2026 that the Bundesamt fuer Cybersicherheit starts work on 1 October 2026, the day the NISG 2026 enters into force, as the national authority under that act. The office sits under the Interior Ministry and consolidates national cybersecurity supervision. From the same day, registration and incident reporting run through the NIS2 Services application in the Unternehmensserviceportal.
Romania: DNSC norms set out how cybersecurity requirements apply inside a group of undertakings
Norms approved by the DNSC on how cybersecurity risk management requirements apply to entities that form part of a group of undertakings were published in Monitorul Oficial Partea I nr. 798 of 21 September 2026. They describe how governance, strategy and risk management defined at group level can satisfy the requirements at subsidiary level, classify controls as inherited from the group, implemented locally to a group standard, or shared, and state that a group level policy on its own is not proof of compliance: each entity remains individually accountable. These are binding national norms under the Romanian NIS 2 transposition, which rests on OUG 155/2024. The DNSC site is not reachable for automated checks, so the citation here rests on the Monitorul Oficial reference reproduced by the Romanian legal publisher JURIDICE.ro.
Belgium: royal decree moves the CCB under the Interior Minister and designates it as national cyber hub
A royal decree of 15 September 2026, published in the Moniteur belge on 21 September 2026, amends the 2014 decree that created the Centre for Cybersecurity Belgium. From 1 January 2027 the CCB, the Belgian NIS 2 authority, falls under the Minister of Security and Interior and the FPS Interior instead of the Prime Minister's Chancellery, and the provision on its status as an operational service is repealed. The explanatory report grounds the change in the NIS2 Law's requirement that the inspection service carry out its tasks independently, including towards the public authorities it supervises. Article 3, which applies ten days after publication, designates the CCB as national cyber hub under Regulation (EU) 2025/38, the Cyber Solidarity Act. The decree is binding but organisational: it changes no duty for essential or important entities.
Italy: ACN consults on enhanced security measures meant to replace the first phase basic measures
At a plenary of the Tavolo NIS on 18 September 2026 the Italian authority ACN opened a consultation with sectoral authorities on misure di sicurezza rafforzate, enhanced security measures built on proportionality and gradualism that are intended to integrate and replace the basic security measures set in the first application phase of D.lgs. 138/2024. ACN also reported that the list of NIS subjects was updated after it handled more than 2,000 late registrations and about 2,000 revision proceedings between May and July 2026, and confirmed that the next registration and update window runs from 1 January to 28 February 2027. The enhanced measures are at consultation stage and are not yet binding.
Poland: the S46 register accepts cross border eID logins ahead of the 3 October registration deadline
The Polish Ministry of Digital Affairs announced on 18 September 2026 that system S46, which operates the register of key and important entities under the amended KSC act, has accepted logins with national eID from other EU and associated states since 2 September 2026. People without a Polish PESEL number can now sign in through login.gov.pl with an eID from one of the supported states and reach the Wykaz KSC and Cyber Hub applications. The self registration deadline for the register remains 3 October 2026, a national deadline under Polish law and not an EU wide one.
Romania: DNSC Order 2/2026 caps how many controls an entity may exclude as not applicable in its maturity self-assessment
DNSC Order no. 2 of 14 September 2026, published in Monitorul Oficial Part I no. 792 of 18 September 2026, completes Order 1/2026 on the catalogue of risk management measures and the maturity self-assessment. Entities may mark controls as not applicable (N/A) up to one control at the basic assurance level, three at the important level and five at the essential level, each with a written justification. Controls marked as key measures can never be excluded, nor can management controls at the essential level. Excluded controls are scored 2.5 at the basic level and 3 at the other levels, and exclusions beyond the cap make the self-assessment non-compliant until they are remedied. Entities in a group of undertakings apply the requirements according to applicability rules approved by decision of the DNSC director. This is a binding national order.
ENISA switches on the CRA Single Reporting Platform as the reporting duties start to apply
ENISA deployed the initial operating capability of the Single Reporting Platform on 11 September 2026, the day manufacturers became bound by the reporting duties of Regulation (EU) 2024/2847 (Cyber Resilience Act). Manufacturers of products with digital elements notify actively exploited vulnerabilities and severe incidents once through the platform: an early warning within 24 hours, a full notification within 72 hours, then a final report within 14 days of a corrective measure being available for a vulnerability or within one month for a severe incident. The notification reaches the CSIRT of the manufacturer's main establishment, which passes it to the other CSIRTs concerned and to ENISA. Open source software stewards are covered from 11 December 2027 under Article 71(2). This first release has no API, so reports go through the web interface.
NIS Cooperation Group publishes the first annual incident overview covering reporting under NIS 2
The 2025 Annual overview on NIS2 Cybersecurity Incident Reporting, stamped September 2026 and listed on the Cooperation Group page on 11 September 2026, is the first edition covering events notified under Article 23 and Article 30 of the NIS 2 Directive. Member States reported 1,954 events for 2025 against 1,508 for 2024, while the number of reporting Member States fell. Malicious action displaced system failure as the most reported root cause for the first time in five years, events caused by system failures lasted 48.3 hours on average against 8.6 hours for malicious ones, public administration replaced health as the most affected sector, and 41 cross-border events were reported by 8 Member States. The report is a Cooperation Group publication based on ENISA's analysis and creates no obligations.
Portugal: about half of the entities CNCS expects had registered in MyCiber days before the deadline
On 11 September 2026 the CNCS told the trade publication IT Security that the number of registrations on the MyCiber platform stood at roughly half of the estimated universe, which the authority puts at more than 5,000 entities under Decreto-Lei n.º 125/2025, up from about 450 under the previous regime. The registration and self-identification deadline is 15 September 2026, 60 working days after Regulamento n.º 756/2026 made MyCiber the live channel on 23 June 2026. This is a national deadline set by Portuguese law, not an EU-wide one, and missing it is a serious breach under the decree.
Italy: ACN publishes the Vademecum per i soggetti NIS with a calendar of obligations
ACN published the Vademecum per i soggetti NIS on 11 September 2026, a general guide to the main obligations under D.lgs. 138/2024 and their deadlines, with sections on keeping entity information current and on the categorization of activities. It names the annual registration and update window of 1 January to 28 February and treats registration as the route into ACN and CSIRT Italia support services. The vademecum is guidance: it does not replace the decree or the ACN determinations that set the measures.
Netherlands: government publishes the supervision cooperation protocol for the Cyberbeveiligingswet
A letter to parliament dated 10 September 2026 announced publication in the Staatscourant of the cooperation protocol on supervision under the Cyberbeveiligingswet, the Dutch NIS 2 transposition, and the Wet weerbaarheid kritieke entiteiten, which transposes the CER Directive. The protocol sets out how the supervisory bodies coordinate now that the Cyberbeveiligingswet has been in force since 15 August 2026. It organises supervision between authorities and does not change the duties entities owe under the act.
Austria: registration and incident reporting move into the USP application NIS2 Services on 1 October 2026
The Unternehmensserviceportal, the Austrian federal business service portal, states on a page updated 8 September 2026 that the NIS2 Services application becomes available in the USP on 1 October 2026, the day the NISG 2026 enters into force, and that entities use it both to register and to report significant cybersecurity incidents. The portal names 1 January 2027 as the date by which initial registration has to be done; the statutory basis is the three month window from entry into force in section 29(3) NISG 2026. The date here is the page update date, because the portal does not carry a separate publication date for the announcement.
Portugal: ANACOM opens the procedure for a sectoral cybersecurity regulation for electronic communications
ANACOM, which Decreto-Lei n.º 125/2025 makes the sectoral cybersecurity authority for electronic communications and postal services, approved on 8 September 2026 the opening of a regulatory procedure towards a Regulamento Sectorial de Ciberseguranca for the electronic communications sector. Contributions can be sent in until 22 October 2026. The planned annexes cover the national cybersecurity reference framework, a risk matrix methodology, minimum measures for essential and important entities, and measures for relevant public entities. Nothing is binding yet: the decision opens the drafting procedure rather than adopting the regulation. The ANACOM site blocks automated fetches, so this entry was confirmed through the public search index of that page.
G7 Cybersecurity Working Group publishes Preparing for the Post-Quantum Era: A Call to Action
Under the French G7 presidency ANSSI led the publication of a joint call to action on post-quantum cryptography, signed by the national cybersecurity agencies of all seven G7 states, with the European Commission and ENISA taking part as guests. It sets five priorities: raising awareness of quantum related cyber risk, national PQC strategies including supply of PQC products, research and deployment, public private cooperation, and writing PQC into cybersecurity requirements and procurement. Organisations are asked to take a phased risk based approach, starting with an inventory of cryptographic assets and a migration plan. The document is non-binding and creates no NIS 2 duty of its own: cryptography requirements for NIS 2 entities remain those set by the Annex to CIR 2024/2690 and national transposition law.
BSI and Sovereign Tech Agency recommend memory safe programming languages
The Sovereign Tech Agency published a position paper recommending memory safe programming languages, with the BSI contributing to the recommendations. It puts memory related flaws at 60 to 70 percent of the vulnerabilities found in large codebases written in languages such as C and C++, and argues that memory safe languages remove that class of error at compile time. The paper proposes migration strategies and EU and national funding for training rather than a blanket rewrite, and the BSI frames it as support for secure by design, which it links to the Cyber Resilience Act. It is a recommendation, not a rule, and neither NIS 2 nor the BSIG is cited in the announcement.
ECCC opens a 96 million euro Digital Europe call that names NIS 2 entities as beneficiaries
The European Cybersecurity Competence Centre opened a call for proposals under the Digital Europe Programme with a budget of up to 96 million euros, open from 1 September 2026 until 14 January 2027 at 17:00 CET. Seven topics are funded, among them 20 million euros for strengthening the cybersecurity capacities of European SMEs with AI supported solutions, 20 million euros for strengthening EU cybersecurity capacities in line with legislative requirements, 15 million euros for coordinated preparedness testing and 11 million euros for the National Coordination Centre network. NIS 2 entities, competent authorities and entities in sectors of high criticality are named as intended beneficiaries. This is funding, not a new obligation.
Slovakia: NBU decree 212/2026 adds a self-assessment every two years to the cybersecurity audit rules
Decree 212/2026 Z. z. of the National Security Authority (NBU), amending audit decree 493/2022 Z. z., took effect on 1 September 2026. A self-assessment, for which the entity's cybersecurity manager is responsible, is carried out every two years and its report goes to the NBU through the single cybersecurity information system by the end of that calendar year. Audits must be completed by the end of the third calendar year after the last audit, or the fifth for an operator of an essential service that is not a critical one and uses the self-assessment track under section 29(8) of the Cybersecurity Act. An audit is also due within six months of any significant change that materially affects the security measures. This is binding national law.
BSI publishes the KRITIS auditor training concept and announces mandatory personal certification
The BSI has published a binding curriculum and a training concept of master slides, a training guide and exercises for the auditors who take the audit team lead role in the evidence inspections that operators of critical installations owe under section 39(1) BSIG. Only the team lead needs the certification, not every auditor on the team. It becomes mandatory with the revised Grundsaetzliche Anforderungen im Nachweisverfahren (GAiN), which the BSI expects in early 2027, and the BSI FAQ adds an 18 month transition after that in which evidence from uncertified leads is still accepted. The route runs through self study, a course from a BSI listed provider, proof of practical experience and an exam at the BSI; the certificate is valid for three years and the earlier Pruefverfahrenskompetenz under section 8a(3) BSIG old version does not count towards it. The basis is section 39(2) BSIG, and nothing changes in what operators themselves owe.
Hungary: government orders a review of SZTFH, the NIS 2 supervisory authority, including the option of winding it up
Government Resolution 1277/2026 (VIII. 31.), published in Magyar Közlöny no. 121 of 31 August 2026, is titled on the review of the Regulated Activities Supervisory Authority and the options for winding it up. It instructs the Minister of Justice to report to the government by 30 September 2026 on how the SZTFH could be dissolved and its tasks transferred to bodies under government direction. The SZTFH supervises cybersecurity under the Hungarian NIS 2 transposition and ran the first mandatory audit cycle that closed on 30 June 2026; it replied on 1 September 2026 that it remains an independent authority accountable to Parliament and will cooperate with the review.
Romania: DNSC Order 1/2026 sets the binding risk management measures and a maturity self-assessment methodology
Order 1/2026 of the director of the DNSC was published in Monitorul Oficial Part I nos. 712 and 712bis of 27 August 2026 and binds essential and important entities under OUG 155/2024. It approves a catalogue of cybersecurity risk management measures organised across governance, identification, protection, detection, response and recovery, plus the methodology for self-assessing how mature those measures are, and it amends the entity risk level methodology set by DNSC Order 2/2025. The DNSC published the matching self-assessment instruments for the basic, important and essential assurance levels at the start of September 2026; entities whose overall risk score has been validated file the self-assessment through the NIS2@RO platform within the period set by OUG 155/2024.
Hungary: SZTFH reports 2,194 entities completed the first cybersecurity audit, close to 90 percent compliant
With all audit reports now processed, SZTFH reports that 2,194 organisations completed the first mandatory cybersecurity audit by 30 June 2026, above the 2,132 on-time figure it published on 10 July. Close to 90 percent met the audit requirements and around 10 percent received the top rating, compliant with negligible risk. Auditors on the SZTFH register had to file their report within seven days of closing an audit. The authority notes that remote access to company systems mattered to the audited organisations but that the documentation of those systems was frequently deficient. The audit is due every two years under Hungary's cybersecurity act and is a national obligation, not an EU-wide one.
Czechia: NÚKIB reports 203 cyber incidents for 2025, the year its NIS 2 transposition took effect
NÚKIB published its annual report on the state of cybersecurity in Czechia for 2025, which the government took note of on 17 August 2026. It records 203 cyber incidents, 65 fewer than the year before, while very significant incidents rose from one to two and significant incidents fell from 18 to 12. Availability attacks accounted for 46 percent of cases, nine in ten surveyed organisations were hit by phishing and more than a third never tested their staff against it. The report treats 2025 as the legislative turning point: the Cybersecurity Act transposing NIS 2 took effect on 1 November 2025 and the NÚKIB portal went live as the central channel for regulated organisations.
Czechia: NÚKIB asks regulated entities which guidance materials they still need under the new Cybersecurity Act
NÚKIB opened an open-ended call for input on which supporting materials and methodologies are still missing for Act 264/2025 Sb., the Czech NIS 2 transposition in force since 1 November 2025 that widened the regulated population substantially. Entities can name unclear topics, unanswered questions and the practical guides they need, by email to regulace@nukib.gov.cz under the subject Podpůrné materiály. There is no closing date and submissions are assessed on a rolling basis. Whatever NÚKIB publishes as a result is guidance and does not change the Act.
BSI NIS-2-in-Zahlen dashboard is live again with figures as at 30 June 2026
The BSI dashboard that returned HTTP 404 on 5 August 2026 is reachable again at its original address. It reports 17,729 entities registered in the BSI portal as at 30 June 2026, of which 11,501 wichtige and 6,215 besonders wichtige Einrichtungen, and 17,945 counting the 216 registered cross-border branches. It adds a sector split and 692 initial incident reports, and announces the next update for 31 October 2026. The BSI publishes no restoration date, so this entry is dated to the earliest verified surfacing. The figure is a month older than the 18,845 reported for the 31 July deadline by a BSI spokesperson via heise.
Netherlands: Cyberbeveiligingswet in force, registration in the entity register now mandatory
The Cyberbeveiligingswet (NIS 2) entered into force on 15 August 2026. Essential and important entities must register in the national entity register via Mijn.NCSC.nl from that date and report any change to their registered data within two weeks. The RDI supervises and can impose a fine or a penalty payment; register data is passed on to ENISA.
Federal government reports 19,058 NIS-2 registrations and says the 29,500 figure is an estimate, not a count of entities in scope
In written answers of 10 and 14 August 2026, published as Bundestag printed paper 21/7573, the federal government reports 19,058 registrations with the BSI by the extended deadline of 31 July 2026, broken down into 12,354 important entities, 6,487 essential entities and 1,378 KRITIS operators inside the essential group. These are the first Tier 1 figures for that deadline and are higher than the 18,845 reported through the press, because the government count includes cross-border branch registrations. It further states that the roughly 29,500 figure underlying the NIS2UmsuCG is an ex ante compliance cost estimate by Destatis from which the actual number of entities in scope cannot be inferred, and that the BSI will open administrative fine proceedings under section 65(2) no. 6 BSIG once it becomes aware of a specific unregistered entity, noting that registrable entities are generally not known to it by name.
Belgium: CCB Inspection Service issues an information request to NIS 2 essential entities on their conformity assessment
The Inspection Service of the Centre for Cybersecurity Belgium, which also acts as national cybersecurity certification authority, addressed a communication and information request to NIS 2 essential entities under Article 48 of the Belgian NIS 2 law. The letter is dated 11 August 2026 and carries the reference NCCA/JK/INS/2026-002; the CCB posted it on its news page on 18 August 2026. Entities are asked to report where they stand on the mandatory conformity assessment and are told what to do when they cannot meet a deadline. The Inspection Service says it will prioritise verifying by 18 April 2027 that essential entities have measures equivalent to CyFun assurance level Important, with assurance level Essential to follow by 18 April 2028 at the latest.
Portugal: government sets out the practical obligations under the new cybersecurity regime, 60 working days to register on MyCiber
The Portuguese government digital portal set out how Decreto-Lei 125/2025 and Regulamento 756/2026 apply in practice. Essential, important and relevant public entities have 60 working days to register and self-identify on the MyCiber platform, and 24 months from qualification by the CNCS to implement the minimum security measures.
ENISA expands its CVE Root to 20 CVE Numbering Authorities
ENISA onboarded the NATO Communications and Information Agency and AISLE as CVE Numbering Authorities, bringing the ENISA Root to 20 CNAs, 12 onboarded directly and 8 transferred from the MITRE Root. ENISA became a CVE Root in November 2025 and runs the European Vulnerability Database provided for by the NIS 2 Directive.
BSI measures security.txt adoption in Germany at 1.8 percent and recommends the file for vulnerability reports
Measurements in the BSI Cyberdome project found that 1.8 percent of website operators in Germany publish a security.txt at /.well-known/security.txt. The BSI and the Allianz für Cyber-Sicherheit recommend the file, standardised in RFC 9116, as a named contact point for coordinated vulnerability disclosure, and point out that reporting duties for actively exploited vulnerabilities and severe security incidents apply from 11 September 2026, with vulnerability handling under the Cyber Resilience Act becoming fully binding in December 2027. The recommendation is guidance and creates no obligation of its own.
BSI publishes Technical Guideline TR-03183-1 version 1.0.0 as a CRA entry aid
Part 1 of TR-03183 (general requirements) reaches version 1.0.0 and is aimed at manufacturers that do not yet have mature security processes in their development work, offering a risk based route to appropriate cybersecurity measures for standard products under the Cyber Resilience Act. The announcement cites 11 September 2026, when reporting duties for actively exploited vulnerabilities and severe incidents begin, and 11 December 2027, when the CRA applies in full, and ships a machine readable OSCAL starter set of measures. The BSI states plainly that the guideline has no mandatory or binding character and cannot establish a presumption of conformity.
Netherlands: NCSC-NL confirms registration becomes mandatory on 15 August with no grace period
Ahead of the Cyberbeveiligingswet entering into force, NCSC-NL states on its registration page that 'De wet treedt op 15 augustus 2026 in werking, vanaf dan is registreren verplicht'. Registration through mijn.ncsc.nl has been open on a voluntary basis since 17 October 2024 and becomes a legal duty on that date; the Cyberbeveiligingsbesluit provides no transitional law, so there is no grace period. Article 44(2) of the Cbw requires changes to registered data to be reported without delay and in any case within two weeks. NCSC-NL published a registration checklist, a scoping decision tree and guidance on the duty of care, incident reporting and supervision between 20 July and 4 August 2026.
Luxembourg: ILR extends both NIS 2 consultations to 31 August and publishes deliverable templates
The ILR extended its two public consultations, CP/N26/1 on security measures and CP/N26/2 on incident notifications, from 6 August to 31 August 2026. Alongside the extension it published four non-binding templates for the security-measure deliverables: a description of the measures in place, an analysis of the main cyber risk scenarios, a multiannual action plan and a list of dependencies. The templates are working aids; the binding deadlines and technical modalities are set by ILR reglements.
BSI registration grace period lapses: 18,845 entities registered, no enforcement opened
The de facto registration date of 31 July 2026 that the BSI had communicated to business associations passed with 18,845 entities registered, 6,490 as besonders wichtige and 12,355 as wichtige Einrichtungen, against an official expectation of roughly 29,500. heise reported the figures on 4 August 2026, attributing them to the BSI, which described registration as an obligation backed by fines while confirming it has so far refrained from opening administrative proceedings. No further deadline was announced, and the Federal Ministry of the Interior has asked Destatis to re-check how many entities are in fact required to register. The BSI hub page now states plainly that the statutory registration deadline has already expired.
BSI updates KRITIS in Zahlen: 1,231 registered operators and 2,180 critical installations
The BSI refreshed its KRITIS in Zahlen statistics page with data as at 30 June 2026: 1,231 registered KRITIS operators running 2,180 critical installations, plus incident reports for the first quarter of 2026 broken down by sector. The BSI notes that a high reporting volume is not in itself an indicator of a sector's security posture.
ENISA publishes the Secure by Design and Default Playbook
ENISA sets out practical steps for applying secure by design and secure by default principles across the product lifecycle, aimed particularly at small and medium enterprises and framed as repeatable actions that attach to existing engineering and product processes. The material ships as a versioned set of playbooks in a public repository rather than as a single report. Non binding technical guidance: it creates no obligation, but the secure by design and default vocabulary it uses is the language of Annex I of the Cyber Resilience Act.
BSIG amended: critical component definition repointed, cyberthreat notification duty reworded
Article 9 of the law of 21 July 2026 (BGBl. 2026 I Nr. 221, published 28 July) amends the BSIG with effect from 29 July 2026, the day after publication. The changes are technical rather than new duties: section 2 no. 23 now points at section 56(6) instead of section 56(7) and (8) for the statutory instrument that designates critical components, and section 35(2) replaces the cross reference to section 35(1) sentence 1 with an explicit reference to essential and important entities, leaving the sector list and the existing duty to inform both affected recipients and the BSI unchanged. Section 33(5) drops the annual reporting track for supply figures and critical component types so that every change to registration data runs on the two week deadline, but it does not apply yet: the new section 66 defers it, and section 33(2), until the statutory instrument under sections 4(3) and 5(1) of the KRITIS-Dachgesetz enters into force.
KRITIS-Dachgesetz amended: software counts as an installation, resilience deadlines cut loose from the calendar
Article 8 of the same law of 21 July 2026 (BGBl. 2026 I Nr. 221) amends the KRITIS-Dachgesetz from 29 July 2026. Section 2 no. 2 brings software and IT services into the definition of an installation, while software and IT services that do not directly serve the control, monitoring or support of physical processes remain governed solely by the BSIG; section 8 sets a three month registration duty through a facility run jointly by the BSI and the BBK, with the types of critical components in use reported to the BSI alone. Because the implementing statutory instrument is still outstanding, section 13(5) replaces the fixed date of 17 January 2026 with a deadline of eight months after that instrument enters into force.
BSI reports updated Minimum Elements for SBOM, revised by CISA with BSI and international partners
CISA, working with the BSI and international partners, has revised its 2021 Minimum Elements for a Software Bill of Materials to improve data quality and widen the range of use cases. The BSI links the revision to its own TR-03183-2, which sets the data fields, scope and formats it expects for SBOMs. Non binding guidance on both sides: the underlying obligation to supply an SBOM comes from the Cyber Resilience Act, not from these documents.
Commission publishes guidance to help businesses implement the Cyber Resilience Act
The European Commission publishes non-binding guidance clarifying how manufacturers and businesses of all sizes apply the Cyber Resilience Act, covering product scope, substantial modifications, support periods and reporting duties. It points to the first reporting obligations from 11 September 2026 and full application from 11 December 2027; CRA product security evidence such as SBOMs also supports NIS 2 supply-chain requirements under Article 21(2)(d).
BSI migrates the Stand-der-Technik-Bibliothek to a layer based structure
The public Grundschutz++ library moved to a layer based structure on 27 July 2026, followed by the removal of superseded AWS component definitions on 28 July and of an obsolete WLAN component on 30 July. The repository still publishes rolling artefacts with no tagged releases, so tooling that reads the library by file path needs to follow the new layout. Non binding: the library is BSI methodology material, and the Kompendium Edition 2023 remains the valid audit reference during the transition.
ENISA opens public consultation on the EU certification scheme for Managed Security Services
ENISA opens a public consultation, running until 13 September 2026, on the first draft of a candidate EU cybersecurity certification scheme for Managed Security Services (EUMSS) under Article 48(1) of the Cybersecurity Act. It targets the fragmentation of managed security requirements across Member States and matters for NIS 2 entities that outsource detection and response to third-party providers.
Italy: ACN reports 1,160 incident notifications in the first half of 2026 under the NIS 2 regime
In its operational summary for January to June 2026, ACN reports that CSIRT Italia handled 2,171 cyber events, 47 percent more than in the same period of 2025, of which 1,072 were incidents with confirmed impact. It received 1,160 notifications, 953 mandatory and 207 voluntary, from 890 entities, 690 of which notified for the first time. The agency attributes the rise to the wider field of view created by the NIS 2 notification duties rather than to a proportional increase in attacks: ransomware cases fell 12 percent to 181 and DDoS events fell 32 percent to 407. Italy transposed NIS 2 with Decreto Legislativo 138/2024, and ACN describes the half year as the first under the full application of those duties.
ENISA publishes procurement guidelines for the cybersecurity of hospitals and healthcare providers
ENISA publishes non-binding procurement guidelines that help hospitals and healthcare providers build cybersecurity requirements into every phase of the procurement lifecycle. Aligned with the NIS 2 Directive, the medical device regulations, the GDPR and the European Health Data Space, it is the first deliverable of the EU Action Plan on the cybersecurity of hospitals and healthcare providers.
Federal cabinet adopts CyberGovSecure as a binding framework for the federal administration
The federal cabinet approved CyberGovSecure on 22 July 2026, turning the programme launched in May into a binding political and organisational framework for coordinated, measurable cybersecurity across all federal departments. The release ties the programme directly to the NIS2 implementation law, under which the head of the BSI takes on the role of federal government coordinator for information security (CISO Bund). Four areas are prioritised for 2026: secure backups, secure configuration and system hardening, vulnerability management, and logging and detection.
Croatia: 798 entities categorised under the Cybersecurity Act, 87 incidents in the second quarter
NCSC-HR published its quarterly review of the implementation of the Zakon o kibernetickoj sigurnosti on 21 July 2026. It records 798 legal persons categorised as obligated entities, of which 162 are essential (kljucni) and 636 important (vazni), and states that the process of determining obligated entities continues. For the second quarter it reports 87 cyber incidents, of which 23 were significant and 64 other incidents, primarily affecting the public sector. Croatia identifies entities through the authority rather than through self-registration, so these are categorisation figures and not registrations.
Croatia publishes the regulation implementing the EU Cyber Solidarity Act
The Uredba o provedbi Akta o kibernetickoj solidarnosti appeared in Narodne novine 78/2026 on 17 July 2026 and enters into force on the eighth day after publication. It gives national effect to Regulation (EU) 2025/38, covering the European cyber alert system, the EU cybersecurity reserve and incident review. This sits alongside NIS 2 rather than inside it: Croatia's NIS 2 transposition remains the Zakon o kibernetickoj sigurnosti (Narodne novine 14/2024).
Commission publishes non-binding resilience guidelines under the CER Directive
Communication C/2026/3712 (OJ 13 July 2026) sets out non-binding guidelines under Article 13(5) of the CER Directive (EU) 2022/2557 on resilience measures for critical entities across six categories, from prevention and physical protection to employee security management. Relevant to NIS 2 because entities identified as critical under CER automatically count as essential entities under NIS 2.
ENISA publishes SME Cyber Resilience Maturity Assessment Model for the CRA
ENISA released a maturity assessment framework for micro and small manufacturers of products with digital elements, with a downloadable assessment tool. Non-binding guidance scoped to the Cyber Resilience Act, adjacent to NIS 2 supply chain duties.
Netherlands: first sectoral NIS 2 regulations published for the water sector
The Infrastructure Ministry published the first sectoral ministerial regulations under the Cyberbeveiligingswet (Stcrt. 2026, 24093) and the Wet weerbaarheid kritieke entiteiten (Stcrt. 2026, 24092), designating CERT-WM as sectoral CSIRT for water authorities and detailing care duty and incident reporting thresholds, plus a decision designating supervisory authorities (Stcrt. 2026, 24155). Effective 15 August 2026 with the parent laws.
Luxembourg: NIS 2 self-registration with the ILR closes 10 July 2026
Entities in scope of NIS 2 in Luxembourg must self-register with the Institut Luxembourgeois de Regulation (ILR) by 10 July 2026, the end of the two-month window that opened when the Law of 5 May 2026 entered into force on 10 May 2026. The ILR is the competent authority, with the HCPN as single point of contact and the CSSF for the financial sector.
Netherlands publishes the Cyberbeveiligingswet in the Staatsblad (Stb. 2026, 187)
The Wet van 8 juli 2026 transposing NIS 2 was published on 10 July 2026 as Stb. 2026, 187, together with the CER-transposing Wet weerbaarheid kritieke entiteiten (Stb. 2026, 188) and the implementing Cyberbeveiligingsbesluit (Stb. 2026, 189). All enter into force on 15 August 2026, when registration via MijnNCSC becomes mandatory.
Hungary: SZTFH closes first NIS 2 audit cycle, 2,132 of 2,520 entities audited on time
Hungary's national first-audit deadline of 30 June 2026 (Act LXIX of 2024) passed with 2,132 of 2,520 registered audit-obligated organisations completing on time; 1,511 audit reports are processed and non-compliant entities face warnings or fines up to HUF 150 million. The 30 June 2026 date is a Hungarian national deadline, not an EU-wide one.
BSI publishes GAiN version 2.2, the baseline requirements for evidence under sec. 39(2) BSIG
Version 2.2 of the Grundsaetzliche Anforderungen im Nachweisverfahren (GAiN), dated 9 July 2026, aligns the audit baseline for KRITIS operators with the amended BSIG and revises the text throughout. Chapter 4 lists the controls that take effect on 1 January 2027 or lapse. GAiN is BSI guidance for the sec. 39 evidence procedure, which KRITIS operators must complete every three years, and does not itself create new statutory duties.
Commission refers Ireland, Spain, France and the Netherlands to the CJEU over NIS 2 transposition
In its July 2026 infringement package the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice of the EU for failing to fully transpose the NIS 2 Directive (EU) 2022/2555, and asked the Court to impose financial sanctions (a lump sum and daily penalty payments). The transposition deadline was 17 October 2024.
Netherlands adopts the Cyberbeveiligingswet (NIS 2), in force 15 August 2026
The Dutch Senate (Eerste Kamer) adopted the Cyberbeveiligingswet (NIS 2 transposition) and the Wet weerbaarheid kritieke entiteiten (CER transposition) on 7 July 2026. Both enter into force on 15 August 2026, from when registration is mandatory via mijn.ncsc.nl. Around 8,000 entities fall under the Cyberbeveiligingswet and about 500 under the CER law.
Commission presents EU Action Plan on Cybersecurity and Artificial Intelligence
The Commission published the EU Action Plan on Cybersecurity and Artificial Intelligence (COM(2026) 577), a non-binding communication on managing AI risks and opportunities in cybersecurity. It creates no new obligations and frames itself as reinforcing implementation of existing law, including NIS 2 and the CRA; ENISA published an aligned paper on AI-era cyber threats the same day.
Ireland: NCSC publishes cyber governance guidance for boards of NIS 2 entities
The Irish NCSC released non-binding guidance for management boards of in-scope entities, built on Belgium's CyberFundamentals (CyFun) framework as its preferred risk-based baseline. It appeared one day before the Commission referred Ireland to the CJEU for non-transposition; the National Cyber Security Bill remains in pre-legislative scrutiny.
Luxembourg: ILR consults on implementing regulations for security measures and incident notification
The ILR opened public consultations on two draft implementing regulations under the NIS 2 law of 5 May 2026: one on security measures and one on notification procedures and criteria for incidents with significant impact (CP/N26/2), days before the 10 July self-registration deadline.
ENISA publishes its view on cybersecurity in the frontier AI era
ENISA published a report for national competent authorities, EU policymakers, defenders and service providers with a first set of recommendations on building the operational capabilities needed against machine speed threats. The report is non-binding technical opinion and does not change obligations under the NIS 2 Directive.
Lithuania: amendment XV-1076 to the Cybersecurity Law enters into force
Law No. XV-1076, adopted by the Seimas on 25 June 2026 and published in the Register of Legal Acts on 3 July 2026, amends the Law on Cybersecurity (No. XII-1428) from 4 July 2026. The size test for essential and important entities now follows the EU SME definition (above the headcount ceiling or above both financial ceilings), with headcount taken from State Social Insurance Fund records and finances from filed annual accounts or tax data; the rule that digital providers registered in Lithuania have their main establishment there is dropped in favour of the NIS 2 Article 26(2) test. Incident reporting (Article 18), risk management measures and fine ceilings are not amended.
ENISA opens NIS360 survey for national authorities and high-criticality entities
ENISA launched a survey on 1 July 2026 inviting national authorities and NIS2 high-criticality entities to contribute to the next edition of its NIS360 sector maturity-and-criticality assessment. Responses are due by 30 October 2026.
Sweden: NIS 2 authority functions and CERT-SE transfer from MCF to the new NCSC
On 1 July 2026 Sweden's NIS 2 single point of contact, CERT-SE and the cybersaekerhetslagen registration function moved from the Myndigheten för civilt försvar (MCF, renamed from MSB on 1 January 2026) to the newly created Nationellt cybersaekerhetscenter (NCSC), hosted at the FRA. Entities register by emailing a form to nis2anmalan@ncsc.se.
Sweden: NIS 2 incident reporting obligations enter into force (MCFFS 2026:8)
The incident reporting and information duty regulations under the Swedish cybersecurity act (MCFFS 2026:8) took effect on 1 July 2026; reports are received by the NCSC at FRA. Regulations on security measures, management training and audits follow on 1 October 2026.
Hungary: first mandatory NIS 2 audit due 30 June 2026 (national deadline, not EU-wide)
Under Hungary's NIS 2 transposition (Act LXIX of 2024, supervised by the Regulated Activities Supervisory Authority SZTFH), in-scope entities had to contract a registered cybersecurity auditor by 31 August 2025 and complete a first mandatory audit by 30 June 2026, following a six-month extension. This is a Hungarian national obligation only: neither the NIS 2 Directive (EU) 2022/2555 nor CIR 2024/2690 sets an EU-wide first-audit deadline, contrary to vendor claims that generalise the date.
Lithuania: amendment XV-894 on collecting cybersecurity fines enters into force
Law No. XV-894, adopted by the Seimas on 12 May 2026 and published in the Register of Legal Acts on 15 May 2026, amends Article 31(13) of the Law on Cybersecurity (No. XII-1428) from 30 June 2026. A fine decision of the National Cyber Security Centre remains an enforceable title, but is now enforced under the Law on Tax Administration as well as the Code of Civil Procedure, and the previous three-year limit for submitting it for enforcement is removed. Decisions that became final by 29 June 2026 are enforced under the old rules. Fine ceilings, the authority that imposes fines and the procedure for imposing them are not amended.
Italy: ACN categorization window for existing NIS subjects closes
The window for entities registered in 2025 to complete activity categorization via ACN's NIS Categorization Service (Determinazione 155238/2026, four relevance levels) ran from 1 May to 30 June 2026. The next milestone for existing subjects is implementing the basic security measures by 31 October 2026.
Netherlands: Senate committees issue second report on Cyberbeveiligingswet, plenary debate set for 6 or 7 July 2026
On 26 June 2026 the Eerste Kamer joint committees for Digitalisation (DIGI) and Justice and Security (J&V) issued their second report (tweede verslag) on the Cyberbeveiligingswet (bill 36.764, the NIS 2 transposition), reopening a written round after the government's 17 June response. The committees now await a second government response, after which the plenary debate is scheduled for 6 or 7 July 2026 ahead of the final Senate vote. The earlier target of entry into force on 1 July 2026 is therefore no longer achievable; the date will be set by koninklijk besluit once the bill passes. The Netherlands remains one of the last laggard Member States completing NIS 2 transposition.
CRA market surveillance authorities (AdCo CRA) meet in Berlin; first reporting obligations from 11 September 2026
The second meeting of the CRA Administrative Cooperation Group (AdCo CRA), chaired by the BSI, took place in Berlin on 25 June 2026. The first Cyber Resilience Act obligations apply from 11 September 2026, when manufacturers of products with digital elements must report actively exploited vulnerabilities and serious incidents via the EU Single Reporting Platform now being built.
ENISA publishes SME CRA Survey Report on Cyber Resilience Act readiness
ENISA published its SME CRA Survey Report, presenting results of a February to March 2026 survey of small and medium enterprises on awareness of and preparedness for the Cyber Resilience Act (CRA). The report identifies the largest gaps against CRA expectations in threat modelling and software bills of materials, and notes that SMEs ask for practical guidance suited to teams without dedicated security staff. The CRA main obligations apply from December 2027.
Portugal: CNCS operating regulation for the MyCiber registration platform enters into force
Regulamento n.º 756/2026, published in the Diário da República (2nd series, no. 118) on 22 June 2026 and in force from 23 June 2026, sets the operating rules for the CNCS-run MyCiber platform (myciber.gov.pt). It operationalises registration and self-identification of entities under the Regime Jurídico da Cibersegurança (Decreto-Lei n.º 125/2025, the Portuguese NIS 2 transposition), turning MyCiber from consultation stage into the live registration channel.
Government bill to strengthen cybersecurity reaches the Bundestag: KRITIS operators would feed attack detection data to the BSI
The federal government's draft Gesetz zur Staerkung der Cybersicherheit reached the Bundestag as Drucksache 21/6585, dated 22 June 2026, after going to the Bundesrat as particularly urgent on 29 May 2026. For NIS 2 regulated entities the main BSIG change is a new section 31(3): operators of critical installations would transmit availability indicators and attack and vulnerability indicators from their attack detection systems to the BSI automatically, twelve months after they first qualify as operators but not before twelve months after the BSI publishes the technical requirements. Section 65 would add fines for not deploying attack detection or not transmitting, and attack detection would drop out of the section 39(1) evidence. DNS service providers with at least 50 employees, or more than EUR 10 million in both annual turnover and balance sheet, would have to offer users DNS based protection against malicious domains. This is a bill, not law: the government rejected all of the Bundesrat's proposals (Drucksache 21/7406, 29 July 2026), and the Interior Committee holds its public hearing on 5 October 2026. The act would enter into force the day after promulgation.
BSI letter to business associations sets de facto registration deadline of 31 July 2026
In a letter to German business associations reported by Tagesspiegel Background and publicly quoted by reuschlaw partner Stefan Hessel on 17 June 2026, the BSI communicates a de facto registration deadline of 31 July 2026 for entities that missed the statutory 6 March 2026 cut-off. Verbatim: 'Da die Registrierungen überfällig sind, gehen wir davon aus, dass alle bis dahin nicht registrierten Einrichtungen die Registrierung bis zum 31. Juli 2026 erfolgreich abschließen.' The BSI grants a narrow exception of six weeks running from the BSI's answer to bundled clarification questions. Legally this is neither a Schonfrist nor a deadline extension: the administrative-offence ground under sec. 65(2) No 6 in conjunction with sec. 65(5) No 5 BSIG (up to EUR 500,000 flat for the sec. 33 registration breach) has applied without interruption since 7 March 2026. The letter is an exercise of BSI's prosecution discretion under sec. 47 OWiG, now anchored to a written, public benchmark. As of 2 April 2026 only 15,477 of an estimated 29,500 in-scope entities had registered. The next BSI NIS-2 in Zahlen update is scheduled for 31 July 2026, the same day. By the end of May 2026 the figure had risen to roughly 18,500 registered entities, which the BSI described as broadly satisfactory.
Netherlands: government files Senate response on Cyberbeveiligingswet, committees set further procedure 23 June
On 17 June 2026 the Dutch government filed its response (nota naar aanleiding van het verslag) to the 2 June Senate committee report on the Cyberbeveiligingswet (bill 36.764, the NIS 2 transposition). The Eerste Kamer committees for Digitalisation and for Justice and Security decide the further procedure on 23 June 2026, the last gate before a plenary vote. The bill passed the lower house on 15 April 2026; the government still targets entry into force on 1 July 2026, subject to Senate approval.
NIS Cooperation Group publishes reference document on NIS2 security measures with mapping table
The NIS Cooperation Group (Member States, the European Commission and ENISA) published a non-binding reference document setting out common cybersecurity objectives for entities in scope of the NIS 2 Directive, deliberately framed in broad terms so they apply across sectors, technologies and operational environments. An annexed mapping table links the objectives to the requirements of the Directive, Commission Implementing Regulation (EU) 2024/2690 and existing international standards and national frameworks, including Belgium's CyberFundamentals (CyFun). It is guidance only and does not replace national transposition law. Belgium's CCB announced it on 17 June 2026; the documents are hosted on the Commission's NIS Cooperation Group page.
AG KRITIS submits statement on the draft KRITIS-Verordnung
Civil-society working group AG KRITIS published its BMI-requested statement on the draft KRITIS-Verordnung (Stand 26.05.2026), calling retention of the 500,000-inhabitant regular threshold the most serious design flaw and criticising the absence of sectors such as chemicals, media and culture.
ENISA-organised Cyber Europe 2026 exercise tests EU response to rail and maritime cyberattacks
On 10 and 11 June 2026 ENISA ran the 8th edition of Cyber Europe with around 5,000 participants from EU Member States, industry and partner countries (UK, Norway, Switzerland, Ukraine). The scenario simulated coordinated cyberattacks on European rail and maritime transport networks escalating into a wider crisis. This was the first EU-wide test of the 2025 EU Cyber Blueprint (Council Recommendation on coordinated response to large-scale cyber incidents) and the first activation drill of the new EU Cybersecurity Reserve under the Cyber Solidarity Act. ENISA notes that rail and maritime subsectors score below average on the NIS360 maturity index relative to their criticality. The exercise stress-tests the cross-border incident response chain that NIS2 Article 23 and the CSIRT network depend on.
BSI publishes BSI-Magazin 2026/01 with cover feature on NIS-2 and BSI-Gesetz
On 11 June 2026 the BSI published the first 2026 issue of its biannual BSI-Magazin under the cover feature 'Mehr Cybersicherheit für Unternehmen mit NIS-2 und BSIG'. The issue marks six months of NIS2UmsuCG being in force (since 6 December 2025) and restates the BSI line that NIS-2 transposition is 'ein Meilenstein auf dem Weg zu einer resilienten Cybernation' (a milestone toward a resilient cyber nation). Other content covers AI in cybersecurity, modernised BSI certification procedures for IT security service providers, biometrics, and ePayment. The magazine is the BSI's main communication channel into government, business and society and signals a narrative shift toward the enforcement phase after the 6 March 2026 registration deadline.
BSI launches survey on its NIS-2 support offerings for business
The BSI opened a questionnaire asking entities in scope of NIS 2 for feedback on its existing support offerings, naming the applicability assessment (Betroffenheitsprüfung), the management training (Geschäftsleitungsschulung) and the #nis2know information packages, and inviting requests for further topics. The survey takes about 20 minutes, is processed anonymously, and ran until 24 June 2026; the stated aim is more practice-oriented assistance for affected companies.
TTE Telecommunications Council reviews progress report on cybersecurity package (CSA2 + NIS2 amendments)
At the Transport, Telecommunications and Energy Council on 9 June 2026 in Luxembourg the Cyprus presidency presented progress reports on the Digital Networks Act and on the cybersecurity package. The cybersecurity package combines the proposed Cybersecurity Act 2 regulation, the targeted amendments to the NIS2 Directive (Commission proposal 20 January 2026) and the new EU-level trusted ICT supply chain security framework. Ministers exchanged views without taking a binding decision; the file remains under examination at COREPER ahead of the Polish presidency from July 2026. First time the cybersecurity package is formally on a Council ministerial agenda since the January Commission proposal.
ENISA publishes SBOM Adoption State of Play 2026
ENISA published survey results on Software Bill of Materials adoption, finding the Cyber Resilience Act is the primary driver of SBOM generation and automation across the software development lifecycle. The supply-chain transparency it documents intersects with the supplier-security obligations under Article 21(2)(d) of the NIS 2 Directive.
European Commission welcomes G7 Cybersecurity Working Group Declaration
On 8 June 2026 DG CONNECT published a Digibyte welcoming the G7 Cybersecurity Working Group Declaration adopted under the French G7 presidency. The declaration commits the G7 to coordinated action on post-quantum cryptography, AI-related cybersecurity risks, telecoms resilience, and SME protection. The Commission explicitly anchors the telecoms-resilience pillar in the NIS2 Directive ('already sets high standards for telecoms resilience') and links the supply-chain pillar to the proposed revised Cybersecurity Act (CSA2) and the new ICT supply chain security framework. Next G7 working group meeting in autumn 2026 before the US takes over the presidency in 2027.
ENISA publishes Technical Competence Requirements for CRA Notified Bodies
ENISA published a report setting out the competences, experience and training requirements for the personnel of conformity assessment bodies seeking notification as Cyber Resilience Act notified bodies. It supports the build-out of conformity-assessment capacity ahead of the 11 December 2026 target for a sufficient number of notified bodies under the CRA.
Netherlands: Dutch Senate committees publish report on Cyberbeveiligingswet, await government response
On 2 June 2026 the Eerste Kamer joint committees for Digitalisation (DIGI) and Justice & Security (J&V) issued the verslag on the Cyberbeveiligingswet (bill 36.764) and parallel Wet weerbaarheid kritieke entiteiten (36.765), formally closing the written input phase opened on 19 May 2026. The committees now await the government's nota naar aanleiding van het verslag before a plenary debate and final Senate vote can be scheduled. Entry into force is still targeted for 1 July 2026 by koninklijk besluit; that timeline now depends on how fast the cabinet responds.
BSI publishes #nis2know infopaket on ISO/IEC 27001 mapping to NIS-2 / sec. 30 BSIG
On 2 June 2026 the BSI added an ISO/IEC 27001 infopaket to the #nis2know series, providing a structured mapping of sec. 30 BSIG requirements against ISO/IEC 27001:2022 controls across ten domains (risk analysis, incident response, business continuity, supply chain, vulnerability management, effectiveness measurement, training/awareness, cryptography, personnel/access, MFA/secure communications). The BSI states explicitly: 'Eine Zertifizierung nach ISO/IEC 27001 bedeutet nicht automatisch, dass ein Unternehmen NIS-2-konform ist.' Authoritative BSI position on the ISO-vs-NIS-2 question that dominates the consulting and audit market.
ENISA opens public review of Agreed Cryptographic Mechanisms version 3 for EUCC
The ECCG cryptography subgroup, supported by ENISA, published a draft version 3 of the Agreed Cryptographic Mechanisms for public review running until the end of July 2026. The document recommends the cryptographic mechanisms preferred for ICT products submitted to EUCC certification and builds on version 2.0 adopted in mid-2025.
ENISA publishes NIS360 2026: third annual maturity-and-criticality assessment of NIS2 sectors
ENISA releases the third edition of NIS360, assessing cybersecurity maturity and criticality of all Annex I high-criticality sectors. Trust services, aviation and financial market infrastructures reach high maturity. Eight sectors sit in the risk zone (maturity lags criticality): health, railway, maritime, ICT service management, space, public administrations, drinking water and waste water. Space and railway show increased criticality. Annual reference document for national authorities and operators planning NIS2 supervisory priorities.
BMI publishes draft of new KRITIS-Verordnung: thresholds and sector list under KRITIS-Dachgesetz
The Federal Interior Ministry releases the referral draft of the new Verordnung zur Bestimmung kritischer Anlagen, replacing the previous BSI-KritisV under the KRITIS-Dachgesetz. The draft adds a new Space sector, keeps IT and telecoms within KRITIS, and adjusts thresholds particularly in energy and transport. Consultation deadline is 16 June 2026. Defines which operators are simultaneously NIS2-essential entities and KRITIS-Dachgesetz operators.
NIS Cooperation Group agrees common incident reporting templates
At its 39th Plenary in Cyprus, the NIS Cooperation Group (Member States, the European Commission and ENISA) agreed common templates for incident reporting under Article 23 of the NIS 2 Directive, giving cross-border entities one uniform format instead of divergent national forms. The Commission intends to make the templates binding through an implementing act.
Dutch Senate committees open written input phase on Cyberbeveiligingswet (NIS2 transposition)
The Eerste Kamer committees for Digitalisering (DIGI) and Justitie en Veiligheid (J&V) opened the written input phase ('inbreng voor het verslag') on the Cyberbeveiligingswet (bill 36.764) and the parallel Wet weerbaarheid kritieke entiteiten (36.765) on 19 May 2026. Senators submit positions before the committees draft short preliminary notes on 21 May. The Tweede Kamer adopted the bill on 15 April 2026; Senate approval is the last step before entry into force, expected 1 July 2026. The Netherlands is one of the remaining laggard member states still completing NIS2 transposition.
European Commission publishes draft Guidelines on classification of high-risk AI systems (Art 6 AI Act)
The European Commission published on 19 May 2026 its draft Guidelines on the classification of high-risk AI systems under Article 6 of the AI Act (Regulation (EU) 2024/1689), together with a targeted stakeholder consultation open until 23 June 2026 (22:00 CET). The 148-page draft sets out the Commission's interpretation of Article 6(1) (Annex I embedded safety components) and Article 6(2) (Annex III standalone high-risk systems), and includes practical use-case examples per Art 6(5). Notable signals for NIS 2-regulated entities: critical-infrastructure high-risk classification under Art 6(2) + Annex III(2) is triggered by CER (Directive 2022/2557) designation, not by NIS 2 'essential entity' status; cybersecurity-purpose AI is explicitly excluded from high-risk (Recital 55); service-quality/operations AI is also excluded. Four Article 6(3) exemption paths preserved despite earlier Commission proposal to delete. Final guidelines expected after consultation close.
BSI signs cybersecurity cooperation agreement with Mecklenburg-Vorpommern (12th federal state)
BSI President Claudia Plattner and Mecklenburg-Vorpommern's Minister for Finance and Digitalization Dr. Heiko Geue sign a formal cooperation agreement in Hamburg, bringing the BSI's federal-state cooperation network to twelve states. Covers operational cybersecurity, mutual information and knowledge exchange, and joint awareness measures. Continues the Bund-Länder coordination push that began with Brandenburg on 29 April 2026 and supports NIS-2 implementation across affected public administration entities.
BSI publishes G7 guideline on Software Bill of Materials for AI
BSI and Italy's ACN co-led the G7 cybersecurity authorities and the EU Commission in producing the 'Software Bill of Materials (SBOM) for Artificial Intelligence' minimum-elements guideline. The document sets minimum requirements across seven information categories including AI models, training data sources, and potential biases. BSI President Claudia Plattner: transparency across the AI supply chain is the foundation for robust AI cybersecurity. Directly relevant to NIS 2 supply-chain risk management under Art 21(2)(d) and to the AI Act compliance pathway.
BMI/BKA Bundeslagebild Cybercrime 2025: ~335,000 cases, EUR 202.4bn damage to German economy
Federal Interior Minister Alexander Dobrindt and BKA Vice President Martina Link present the Bundeslagebild Cybercrime 2025 on 12 May 2026. About 335,000 cybercrime cases in the narrow sense were registered in 2025; two-thirds (207,888) committed from abroad or from unknown locations. Estimated damage to the German economy: EUR 202.4 billion, roughly 4.5 percent of GDP. AI-based tools are increasingly used by attackers; companies, public authorities and critical infrastructure are the principal targets. Dobrindt frames the response in NIS-2 enforcement terms: 'The state must not be a spectator in the digital space.' Provides political backdrop for the BSI's transition into the active NIS-2 audit phase started in May 2026.
BSI Cybersecurity Monitor 2026: one in ten Germans hit by cybercrime in the past year
Joint BSI and ProPK survey finds 27% of Germans have been victims of cybercrime, including 11% in the past 12 months. Most common offences: online shopping and banking fraud, account compromise, and phishing. Only 14% regularly inform themselves about cybersecurity; 33% of affected individuals report financial losses. The report underscores the broad awareness gap that NIS 2 supervision and BSI education programmes aim to close on the consumer side.
Luxembourg transposes NIS 2: Act of 5 May 2026 enters into force
Luxembourg's Act of 5 May 2026 on measures to ensure a high level of cybersecurity entered into force on 10 May 2026, transposing the NIS 2 Directive and repealing the previous NIS 1 Act. The Institut Luxembourgeois de Regulation (ILR) is the competent authority; a self-registration portal for in-scope entities is live. Notable because Luxembourg was one of the laggard member states and had been referred to the CJEU under the parallel CER infringement procedure days earlier on 29 April 2026. NIS 2-scope entities must self-register with the ILR.
AI Act Digital Omnibus: provisional political agreement reached
Council and European Parliament reached provisional political agreement on the AI Act Digital Omnibus in the early hours of 7 May 2026. Delays Annex III high-risk obligations to 2 December 2027 and Annex I embedded high-risk to 2 August 2028. Watermarking under Art 50(2) deferred to 2 December 2026. Adds new Art 5 prohibition on AI generating non-consensual intimate imagery and child sexual abuse material. Extends SME relief to small mid-cap enterprises. Formal Council and Parliament adoption required before 2 August 2026.
BSI publishes first IT security report on public EV charging infrastructure
BSI and the Federal Ministry for Transport release the first joint report analysing IT security of Germany's public EV charging infrastructure. The report examines protocol-level deficiencies in ISO 15118 and OCPP as well as software weaknesses across charging point operators, and proposes concrete security measures. BSI positions charging infrastructure at the intersection of NIS 2 transport and energy sectors: failures cascade from mobility disruption to grid-level effects.
BSI launches CyberGovSecure programme: coordinated NIS-2 implementation across German federal administration
BSI, CISO Bund and the Federal Ministry for Digital Affairs and State Modernization launched CyberGovSecure on 4 May 2026, a structured cross-departmental programme to roll out cybersecurity measures across all German federal authorities. BSI President Claudia Plattner described it as a central building block for NIS-2 implementation in the federal administration. Implementation responsibility rests with each authority; BSI provides technical and organisational support.
BSI signs cybersecurity cooperation agreement with state of Brandenburg
BSI President Claudia Plattner and Brandenburg State Secretary Ernst Bürger sign a formal cooperation agreement covering ten action areas: operational cybersecurity (information management, security tests and exercises), joint awareness and training programmes, and mutual exchanges to build technical expertise. Strengthens federal-state coordination in support of NIS2 implementation across public administration entities now in scope.
Commission refers 7 member states to CJEU for failing to transpose CER Directive
European Commission decided on 29 April 2026 to refer Bulgaria, France, Luxembourg, the Netherlands, Poland, Spain and Sweden to the Court of Justice of the EU for failing to transpose the CER Directive (EU 2022/2557), requesting financial sanctions in each case. CER and NIS 2 share the same 17 October 2024 transposition deadline; this is the first major CJEU enforcement action under the package. Procedural sequence: formal notice November 2024, reasoned opinion July 2025, CJEU referral April 2026. Strong enforcement signal for the parallel NIS 2 infringement track.
BSI publishes C3A criteria framework for cloud sovereignty
BSI releases the Criteria enabling Cloud Computing Autonomy (C3A) framework establishing transparent sovereignty standards for cloud services. C3A complements the existing C5 catalogue by addressing 'Cyber Dominance', the ability of cloud manufacturers to maintain permanent access to customer systems and data. Cloud providers must meet C5 prerequisites; the framework offers flexibility on data localisation (Germany or EU). Aligned with the European Cloud Sovereignty Framework (EU CSF). Not regulatory; supplements rather than replaces NIS2 cloud certification pathways.
Public feedback period closes for proposed NIS2 Directive amendments
The public feedback period for the European Commission's proposed NIS2 amendments (published January 20, 2026) closes today. Proposals include submarine infrastructure in scope, small mid-cap entity category, ransomware reporting details, strengthened ENISA cross-border supervision role, and certification-based compliance pathways. Ordinary legislative procedure in Parliament and Council follows.
ENISA publishes National Capabilities Assessment Framework 2.0
ENISA released NCAF 2.0, an updated methodology for assessing national cybersecurity capabilities and strategy maturity. Aligned with NIS2 Article 19 peer review process. Supports Member States in identifying strengths, gaps, and priority areas in cybersecurity at strategic and operational levels.
Belgium enforces first NIS2 compliance deadline: essential entities must prove cybersecurity posture
Belgium becomes the first EU country to enforce ex-ante NIS2 supervision. By April 18, essential entities must submit verified cybersecurity documentation via one of three pathways: CyberFundamentals (CyFun) verification, ISO/IEC 27001 certification, or direct CCB inspection request. Non-compliance triggers administrative measures and fines up to 10M EUR or 2% of turnover. Full certification for essential entities due April 18, 2027.
BSI publishes v1.0 of management training guidance for §38(3) BSIG
The BSI released version 1.0 of its 24-page Handreichung 'Schulung für Geschäftsleitungen' on 17 April 2026, updating the preliminary v0.9 from September 2025 after consultation with Bitkom, DIHK, GI, VDMA, Zentralverband Handwerk and ZVEI. The document defines the regulator's expectations for the §38(3) BSIG management training obligation across three blocks: training organisation (audience, intervals, formats, providers, evidence), recommended content (SOLL/KANN structure covering risk analysis, risk management practices and impact assessment), and a guided self-check (10 sections of Leitfragen with helpful vs red-flag answers). Eight training formats are explicitly endorsed including quarterly risk-management sessions with the CISO, tabletop exercises, audit simulations and management red/blue teaming. Documentation must record provider, participants with role, date/time/duration and contents with statutory references.
21st German IT Security Congress concludes: 8,000 participants, NIS2 and AI security in focus
BSI hosts the 21st IT-Sicherheitskongress in Bonn on April 15-16 under the theme 'Cybernation Deutschland'. Eight sessions cover NIS-2 implementation, AI security, post-quantum cryptography, zero trust, secure supply chains, and digital identity. Hybrid workshops address Grundschutz++ 'state of the art' and EUDI-Wallet topics. Congress content remains accessible through May 15.
Netherlands passes Cyberbeveiligingswet (NIS2 transposition) in lower house
The Dutch Tweede Kamer approved the Cyberbeveiligingswet and the Wet weerbaarheid kritieke entiteiten (CER implementation) on April 15, 2026. The Cyberbeveiligingswet replaces the existing Wbni and implements NIS2 obligations including care duties, reporting requirements, and registration. Entry into force expected July 1, 2026 pending Senate approval.
BSI Congress reveals NIS-2 implementation far behind expectations: companies deliberately avoiding registration
At the 21st IT Security Congress, BSI official Manuel Bach disclosed that NIS-2 registration remains far below expectations. Nearly 50% of German companies had never heard the term 'NIS-2' as of late 2025. Some companies are deliberately choosing not to register after consulting leadership and legal counsel. Bach compared non-compliance to tax liability: 'one cannot decide for oneself whether it applies.'
DENIC launches Phase 2 automated domain risk assessment for .de domains under NIS2
DENIC activates Phase 2 of its NIS2 implementation for .de domain registrations. An automated risk assessment system using a traffic light principle (Low/Suspicious/High Risk) now classifies all contact and domain orders. Anomalies in registration data trigger verification requests to the responsible DENIC member. Unverified domains face DNS quarantine and potential deletion. Phase 1 (December 6, 2025) had already made corporate domain owner data publicly visible in WHOIS. Affects all ~17 million .de domains.
BSI publishes C5:2026 cloud computing criteria catalogue
BSI released C5:2026, the updated Cloud Computing Compliance Criteria Catalogue replacing the 2020 version. The new edition covers container management, post-quantum cryptography, and confidential computing, aligns with the European EUCS certification scheme, and explicitly considered the NIS2 Directive in its design alongside ISO/IEC 27001:2022 and the CSA Cloud Controls Matrix v4. Will be released in machine-readable format for the first time.
Malta: amendment order sets up an Enforcement Committee and daily penalty payments
Legal Notice 89 of 2026, published in Government Gazette No. 21,618 on 7 April 2026, amends the Maltese NIS 2 Order (S.L. 460.41). It establishes an Enforcement Committee, appointed by the minister from senior public officers and senior staff of other organisations with a main interest in the field, which may impose the Order's administrative fines on entities that the CIP Department, or a designated competent authority, reports as non-compliant, after letting the entity make submissions. Where an entity repeatedly fails to stop or rectify an infringement after a prior decision, the Committee may impose a daily penalty payment of EUR 100 for each breach for every day it persists, which may be backdated to when the breach began. This is binding national law.
Poland's amended KSC Act enters force: 42,000 entities now in scope
Poland's amended National Cybersecurity System (KSC) Act enters force on April 3, 2026, expanding NIS2 scope from ~400 to ~42,000 organizations including ~28,000 public sector bodies. New sectors added: food production, waste management, chemicals, postal services, manufacturing. Entity registry launched April 13 via the S46 platform. Self-registration deadline: October 3, 2026. Full compliance required by April 3, 2027.
Portugal: Decreto-Lei n.º 125/2025 enters into force
Portugal's NIS 2 transposition enters into force on 3 April 2026, 120 days after publication. Cybersecurity officer notification due within 20 working days of entry into force. CNCS operates the electronic registration platform.
Poland: UKSC amendment of 23 January 2026 enters into force
The Polish UKSC amendment enters into force on 3 April 2026. Ministerstwo Cyfryzacji is the lead competent authority; three national CSIRTs operate in parallel (CSIRT NASK for private sector, CSIRT GOV inside ABW, CSIRT MON for military). Twelve-month grace period to implement Chapter 3 security measures (3 April 2027).
BSI publishes Grundschutz++ methodology guide: PDCA-based ISMS framework
BSI releases the first methodology guide for Grundschutz++, establishing a forward-looking framework for systematically building an ISMS based on the PDCA cycle. The guide integrates strategic planning, requirements analysis, implementation, monitoring, and continuous improvement. Currently designated for pilot projects only. Edition 2023 remains the valid audit reference through 2028.
EDPB and EDPS adopt Joint Opinion 4/2026 on NIS2 amendments and Cybersecurity Act 2
EU data protection authorities formally endorse strengthening cybersecurity while raising data protection guardrails: welcome Digital Identity Wallet providers as essential entities, call for ENISA-EDPB consultation before adopting certification schemes touching personal data, recommend single-entry point for breach notifications to reduce administrative burden, and urge clarity on GDPR-cybersecurity certification overlap.
BSI and Govdigital announce 'Cyberdome': automated cyber defense for 10 federal states
BSI and public IT providers association Govdigital announce Cyberdome: sensor-based automated cyber defense infrastructure across 10 federal states and municipalities with real-time BSI-linked monitoring.
KRITIS-Dachgesetz enters into force: physical security on top of NIS2 cyber requirements
Germany's CER Directive transposition (KRITIS-Dachgesetz) enters into force, adding physical security and resilience requirements on top of NIS2 cybersecurity. Requires BCMS alongside ISMS, physical security controls, and triennial audits. Penalties up to €1M.
France: ANSSI publishes the Referentiel Cyber France ahead of transposition
ANSSI made the Referentiel Cyber France (ReCyF) available from 17 March 2026, listing the measures it recommends for meeting the security objectives set by NIS 2. It is circulated as a working document and is voluntary by default, though entities that apply it can rely on it during an ANSSI inspection, and it corresponds to the cybersecurity framework named in article 14 of the resilience bill. ANSSI states that no final version will be published while the transposition is unfinished. A comparison tool on MesServicesCyber maps ReCyF against other frameworks including the ISO 2700x series and the Annex to CIR 2024/2690, and a pre registration service for future essential and important entities is already open.
Cyber Security Report 2026: 92% of small German firms misunderstand NIS2 scope
Schwarz Digits' Cyber Security Report 2026 surveys 1,001 German companies and finds 48% mistakenly believe they are not affected by NIS2. Among small companies (10-49 employees, >€10M revenue) the misconception rate reaches 92%, even though they meet the regulatory threshold.
BSI launches NIS2 FAQ specifically for public administration
BSI publishes a dedicated FAQ addressing NIS2 applicability and compliance requirements for federal, state, and municipal government entities.
BSI publishes NIS-2 implementation checklist for affected entities
BSI released a downloadable NIS-2-Checkliste on 13 March 2026 as a practical step-by-step tool for affected entities to verify implementation of NIS-2 / BSIG duties. The checklist sits in the #nis2know-Downloads package alongside the affected-entities decision tree and the public-administration FAQ that landed the same day. Currently at version 9, indicating ongoing iteration on the basis of operator feedback. Addresses registration, governance, risk management, supply-chain, incident reporting and training obligations.
ENISA publishes Technical Advisory for Secure Use of Package Managers
New guidance on secure software development lifecycle focusing on package manager security, directly relevant for NIS2 supply chain security requirements (Art. 21(2)(d)).
22 of 27 EU member states have completed NIS2 transposition
Cullen International reports 22 EU states have transposed NIS2. Five remain: France, Ireland, Luxembourg, Netherlands (legislation in parliament) and Spain (no draft submitted). Spain is the furthest behind.
BSI registration deadline passes: fines now possible for non-registration
Three months after BSIG entry into force, the mandatory registration deadline at the BSI portal expires. Late registration is still accepted but penalties of up to €500,000 for the registration breach (§ 65(2) No 6 BSIG) are now legally enforceable.
Only ~11,500 of ~29,500 affected entities registered by the deadline
By the March 6 deadline, approximately 11,500 authorities, companies, and other critical facilities registered with the BSI under NIS2, leaving around 18,000 of the 29,500 obligated entities still missing. The BSI spokesperson said it remains unclear whether the original estimate was too high or whether large numbers of affected parties simply failed to comply.
BOS digital radio operator receives ISO 27001/IT-Grundschutz certification
Germany's public safety digital radio (BOS) network operator achieves ISO 27001 certification on IT-Grundschutz basis, demonstrating critical infrastructure security compliance.
Poland publishes UKSC amendment in Dziennik Ustaw (Dz.U. 2026 poz. 252)
Adopted by the Sejm on 23 January 2026, signed by the President on 19 February 2026, the amendment to the Polish National Cybersecurity Act (UKSC) is published in the Journal of Laws on 2 March 2026 as Dz.U. 2026 poz. 252. Amends 21 statutes including the 2018 UKSC. Enters into force 3 April 2026.
Public comment period opens for CRA compliance technical guideline
BSI opens public comment period for the Cyber Resilience Act (CRA) compliance technical guideline, connecting product security requirements with NIS2 supply chain obligations.
BMI publishes draft Active Cyber Defense Act: new obligations for NIS2-regulated entities
Federal Interior Ministry presents the Gesetz zur Stärkung der Cybersicherheit, granting BKA, Federal Police, and BSI active cyber defense powers including disrupting attacker infrastructure. Adds obligations for NIS2-regulated entities: mandatory cooperation during state-led cyber operations, attack detection systems connected to BSI, and DNS-based protection for customers. Fines up to €20M or 2% of global turnover. Requires ~375 new government positions by 2030.
Poland signs NIS2 transposition into law: enters force April 2, 2026
President Nawrocki signs the amendment to Poland's National Cybersecurity System Act (UKSC), transposing NIS2 into Polish law. Enters force April 2 after one-month vacatio legis. Entity registration deadline: October 3, 2026. Full compliance deadline: April 3, 2027. President simultaneously refers provisions on high-risk providers and penalties to Constitutional Tribunal.
ENISA releases Cybersecurity Exercise Methodology framework
New methodology for planning, running, and evaluating cybersecurity exercises, relevant for NIS2 entities required to test incident response capabilities under Art. 21.
NIS Cooperation Group adopts ICT Supply Chain Security Toolbox
The NIS Cooperation Group publishes a common framework for identifying, assessing, and mitigating cybersecurity risks across ICT supply chains. The toolbox includes risk scenarios, mitigation measures, and guidance on reducing dependencies on high-risk suppliers. Accompanied by sector-specific risk assessments for connected vehicles and detection equipment.
Bulgaria: NIS 2 transposition (Cybersecurity Act amendment) promulgated and in force
The NIS 2 Directive (EU) 2022/2555 is transposed in Bulgaria by the Act amending and supplementing the Cybersecurity Act, adopted by the National Assembly on 5 February 2026 and promulgated in the State Gazette (Darzhaven vestnik) issue 17 of 13 February 2026. It splits obliged organisations into essential and important entities and introduces management accountability and risk management duties; reduced penalties apply for initial breaches until 1 July 2026.
ENISA publishes International Strategy for cybersecurity cooperation
ENISA releases its international cooperation strategy outlining how the agency works with non-EU partners on cybersecurity standards and threat intelligence sharing.
Südwestfalen-IT receives ISO 27001 certification on IT-Grundschutz basis
Following the devastating 2023 ransomware attack, the municipal IT provider Südwestfalen-IT achieves ISO 27001 certification based on IT-Grundschutz, demonstrating recovery and security maturity.
Malta: commencement notice brings all provisions of the NIS 2 Order into force
With Legal Notice 22 of 2026, published in Government Gazette No. 21,575 on 23 January 2026, the minister responsible for critical infrastructure protection set 23 January 2026 as the date on which all the provisions of the Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, 2025 (S.L. 460.41, Legal Notice 71 of 2025) come into force. This is binding national law.
EU proposes NIS2 amendments: new entity types, harmonization ceiling, PQC migration
European Commission unveils cybersecurity package with targeted NIS2 amendments: submarine infrastructure and digital wallet providers added, new 'small mid-cap' category (~22,500 companies), mandatory ransomware reporting details, and post-quantum cryptography migration deadlines (2030/2035).
Sweden: Cybersäkerhetslagen (SFS 2025:1506) enters into force
Sweden's NIS 2 transposition enters into force on 15 January 2026. The old 2018 NIS 1 act is repealed but continues to apply to events occurring before this date.
First EUCC cybersecurity certificate issued under EU framework
The first European Cybersecurity Certification (EUCC) certificate is issued, establishing a common EU-wide certification scheme that NIS2 entities can use to demonstrate compliance.
BSI NIS2 registration portal launches
BSI launches portal.bsi.bund.de for NIS2 entity registration and incident reporting. Registration requires an ELSTER organizational certificate (activation letter by post, per the BSI regularly at least five working days; existing certificates can be reused).
Grundschutz++ transition phase begins: parallel operation through 2029
BSI officially launches the Grundschutz++ modernization transition. Machine-readable OSCAL/JSON format replaces PDF/Excel. Edition 2023 remains valid for audits during the transition through 2029.
Sweden: MSB renamed to MCF (Myndigheten för civilt försvar)
On 1 January 2026 the Swedish Civil Contingencies Agency (MSB) was renamed Myndigheten för civilt försvar (MCF, in English the Swedish Civil Defence and Resilience Agency), after the Riksdag approved the government's bill on 5 November 2025. MCF kept CERT-SE and the NIS 2 single point of contact role until 30 June 2026; on 1 July 2026 both moved to the new Nationellt cybersäkerhetscenter (NCSC) at the FRA.
Estonia: amended Cybersecurity Act (NIS 2 transposition) enters into force
The NIS 2 Directive (EU) 2022/2555 is transposed in Estonia by the Act amending the Cybersecurity Act and other Acts (Küberturvalisuse seaduse ja teiste seaduste muutmise seadus), which entered into force on 1 January 2026 and broadens the set of essential and important entities subject to cybersecurity duties.
2025
Austria enacts NIS 2 transposition (NISG 2026)
The NIS 2 Directive (EU) 2022/2555 was transposed into Austrian law by the Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), BGBl. I Nr. 94/2025, published on 23 December 2025. The law was enacted but enters into force on 1 October 2026, until which the NISG 2018 continues to apply.
Austria: NISG 2026 published in the Federal Law Gazette, entering into force 1 October 2026
Austria promulgated the Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026) as BGBl. I Nr. 94/2025 on 23 December 2025, transposing NIS 2 and amending the Telekommunikationsgesetz 2021 and the Gesundheitstelematikgesetz 2012. Under section 51 the substantive provisions enter into force on the first day of the month following nine months after promulgation, that is 1 October 2026, repealing the 2018 NISG, and section 29(3) requires entities to register with the cybersecurity authority within three months of entry into force.
Sweden: Cybersäkerhetslagen (SFS 2025:1506) issued
Cybersäkerhetslagen (SFS 2025:1506) (Sweden's NIS 2 transposition) is issued on 11 December 2025 on the basis of Proposition 2025/26:28 'Ett starkt skydd för nätverks- och informationssystem'. Enters into force 15 January 2026. Decentralised supervision via sector regulators; MCF (Myndigheten för civilt försvar) is national SPOC and hosts CERT-SE.
BSIG enters into force: NIS2 is law in Germany
The amended BSIG enters into force on St. Nicholas Day, over a year after the EU transposition deadline. No transition period: all obligations are immediately effective for ~29,500 affected entities.
NIS2UmsuCG published in Federal Law Gazette (BGBl. 2025 I Nr. 301)
The NIS-2-Umsetzungs- und Cybersicherheitsstärkungsgesetz is published in the Federal Law Gazette, entering into force the following day.
Portugal publishes Decreto-Lei n.º 125/2025 in Diário da República
Portugal's NIS 2 transposition appears in the Diário da República on 4 December 2025. Decreto-Lei n.º 125/2025 establishes the Regime Jurídico da Cibersegurança with CNCS (Centro Nacional de Cibersegurança) as the lead authority and CERT.PT as the national CSIRT (integrated into CNCS). Enters into force 3 April 2026 (120 days after publication).
Bundestag passes NIS2UmsuCG: Germany's NIS2 implementation law
German parliament passes the NIS2UmsuCG in 2nd and 3rd readings. Votes: CDU/CSU + SPD + AfD in favor, Greens against, Die Linke abstained. Approximately 29,500 entities now fall under BSI supervision.
Coalition agrees on NIS2UmsuCG compromises: ex-post model for critical components
CDU/CSU-SPD coalition reaches agreement: critical component regulation shifts from ex-ante approval to ex-post notification model. Federal CISO role transferred to BSI in Bonn.
Czech Republic: Act 264/2025 Sb. on Cybersecurity enters into force
Zákon č. 264/2025 Sb. enters into force on 1 November 2025. Initial wave (entities already in scope at entry into force) must self-identify and register through portal.nukib.gov.cz by 31 December 2025. Entities entering scope later have 60 days.
Denmark: registration deadline for entities under the NIS 2-loven
Entities covered by the Danish NIS 2-loven had to register through the SAMSIK service on virk.dk by 1 October 2025. An entity that comes within the act's scope after that date must register no later than two weeks after it becomes covered. This is a national deadline under Danish law.
Greece: extended NIS 2 registration deadline of 30 September 2025
Joint ministerial decision no. 1990, published in the Government Gazette (FEK B 4241) on 4 August 2025, extended to 30 September 2025 the deadline for entities to submit their details for entry in the National Cybersecurity Authority's register under Article 4(3) of Law 5160/2024, as well as the submission deadline under Article 19(1) of the same law. Registration runs through the authority's platform nis2register.cyber.gov.gr. This is a national deadline under Greek law.
BSI publishes Grundschutz++ preview on GitHub (OSCAL/JSON)
BSI releases the Stand-der-Technik-Bibliothek on GitHub with preview of abstract requirements in OSCAL/JSON format. Not production-ready: initial draft only, concrete measures still being added.
Slovakia: NBU decrees on security measures and incident notifications take effect
Two decrees of the National Security Authority (NBU), approved on 26 August 2025 and announced on 28 August 2025, took effect on 1 September 2025: Decree 227/2025 Z. z. on security measures and Decree 226/2025 Z. z. setting out the details of incident notifications. They implement the Slovak Cybersecurity Act as amended for NIS 2. This is binding national law.
Czech Republic publishes Cybersecurity Act 264/2025 Sb. in Sbírka zákonů
Adopted 11 June 2025, published in the Czech Collection of Laws on 4 August 2025, the new Zákon č. 264/2025 Sb. o kybernetické bezpečnosti replaces the 2014 cybersecurity act and transposes NIS 2. NÚKIB is the lead supervisor; GovCERT.CZ is operated inside NÚKIB; CSIRT.CZ is run by CZ.NIC. Two-tier regime (higher / lower significance). Penalty cap CZK 250 million for the higher regime.
German cabinet approves NIS2UmsuCG draft law
The German federal cabinet approves the draft NIS-2-Umsetzungs- und Cybersicherheitsstärkungsgesetz, forwarding it to parliament. The bill was fast-tracked due to the missed EU deadline.
Romania: NIS 2 transposition (OUG 155/2024, approved by Law 124/2025) enters into force
The NIS 2 Directive (EU) 2022/2555 is transposed in Romania by Government Emergency Ordinance OUG 155/2024 of 30 December 2024 (Monitorul Oficial no. 1332 of 31 December 2024), approved with amendments by Law 124/2025 (Monitorul Oficial no. 638 of 7 July 2025), in force from 10 July 2025. The DNSC is the competent national cybersecurity authority for essential and important entities.
Latvia: Cabinet Regulation No. 397 on minimum cybersecurity requirements enters into force
Cabinet Regulation No. 397, Minimālās kiberdrošības prasības, adopted on 25 June 2025 and published in Latvijas Vēstnesis No. 122, entered into force on 2 July 2025. It sets the minimum cybersecurity measures that essential and important entities and owners of critical ICT infrastructure apply under the National Cybersecurity Law, including risk management, incident reporting, network segmentation, log retention, backups, access control and security testing. The National Cybersecurity Centre states that entities managing critical ICT infrastructure or class A information systems submit a self-assessment every year and other entities every three years. This is binding national law.
Denmark: NIS 2-loven (LOV nr 434) enters into force
Adopted by the Folketing on 29 April 2025, signed 6 May 2025, the Danish NIS 2 law (Lov om foranstaltninger til sikring af et højt cybersikkerhedsniveau) enters into force on 1 July 2025. Self-registration via virk.dk with MitID by 1 October 2025. Energy sector follows the parallel LOV nr 258 of 6 March 2025.
ENISA publishes NIS2 Technical Implementation Guidance v1.0
170-page document translating CIR 2024/2690 into practical measures across 13 thematic areas with evidence examples and standards mappings. Primary reference for NIS2 compliance implementation.
Slovenia: Information Security Act (ZInfV-1) (NIS 2 transposition) enters into force
The NIS 2 Directive (EU) 2022/2555 is transposed in Slovenia by the Information Security Act (Zakon o informacijski varnosti, ZInfV-1), published in Uradni list RS 40/25 on 4 June 2025 and in force from 19 June 2025. It defines essential and important entities and assigns supervision to the national information security authority URSIV.
Commission sends reasoned opinion to 19 Member States for NIS 2 transposition failure
Step 2 of the infringement procedure: 19 Member States that had not notified full transposition of NIS 2 by the 17 October 2024 deadline receive a reasoned opinion from the Commission. The list includes Germany, France, Spain, Netherlands, Sweden, Finland, Denmark, Portugal, Ireland, Poland and others. Next step: referral to the CJEU.
Cyprus transposes NIS 2 with Law 60(I)/2025
The NIS 2 Directive (EU) 2022/2555 was transposed into Cypriot law by the Security of Networks and Information Systems (Amendment) Law of 2025, Law 60(I)/2025, which amends Law 89(I)/2020 and came into force on 25 April 2025. The amendment widens the set of essential and important entities and tightens risk management and incident reporting duties.
Finland: Cybersecurity Act 124/2025 enters into force
The Finnish Parliament approved Kyberturvallisuuslaki on 13 March 2025; it enters into force as Act 124/2025 on 8 April 2025. Initial registration deadline 8 May 2025. Traficom coordinates; NCSC-FI is the national CSIRT and EU Single Point of Contact. Decentralised supervision via sector regulators (Energiavirasto, Finanssivalvonta, Tukes).
Malta enacts NIS 2 transposition via Legal Notice 71 of 2025
The NIS 2 Directive (EU) 2022/2555 was transposed into Maltese law by the Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, 2025, Legal Notice 71 of 2025 (S.L. 460.41), published in Government Gazette No. 21,418 of 8 April 2025. Its provisions take effect on dates set by the responsible minister, so the order is enacted with phased commencement.
Latvia: deadline for essential and important entities to notify the National Cybersecurity Centre
Under transitional provision 7 of the National Cybersecurity Law, in force since 1 September 2024, essential and important entities had to notify the National Cybersecurity Centre no later than 1 April 2025. This is a national deadline under Latvian law.
France: Senat adopts the resilience bill carrying the NIS 2 transposition at first reading
The French Senate adopted at first reading the projet de loi relatif a la resilience des infrastructures critiques et au renforcement de la cybersecurite, the single vehicle that transposes NIS 2 together with the CER Directive and parts of DORA. The government had tabled it on 15 October 2024 under the accelerated procedure; it was transmitted to the Assemblee nationale on 13 March 2025 and the special committee reported on 10 September 2025. No plenary vote had followed at the Assemblee nationale as at early September 2026, and the Commission referred France to the CJEU on 8 July 2026 for non transposition.
Denmark: CFCS becomes part of SAMSIK
On 29 January 2025 Styrelsen for Samfundssikkerhed (SAMSIK, the Danish Resilience Agency) was established under the Ministry of Resilience and Preparedness by bringing together units from several ministries, including the Centre for Cyber Security (CFCS). The royal resolution of 29 August 2024 had moved cyber security, NIS 2 implementation and CFCS out of the Ministry of Defence; only the Netsikkerhedstjenesten and the parts of CFCS handling operational defensive cyber operations and defence tasks stayed there. The national CSIRT is among the functions SAMSIK took over, and cfcs.dk now redirects to samsik.dk.
Spain: Council of Ministers approves the draft Cybersecurity Coordination and Governance Act
The Spanish Council of Ministers approved the Anteproyecto de Ley de Coordinacion y Gobernanza de la Ciberseguridad, the bill that transposes NIS 2 into Spanish law. It creates a Centro Nacional de Ciberseguridad attached to the Presidency as the single competent national authority, single point of contact for cross border cooperation and national cyber crisis management authority, with supervision distributed across sector authorities. The bill had still not been published in the BOE as at September 2026, Royal Decree 43/2021 continues to apply in the meantime, and the Commission referred Spain to the CJEU on 8 July 2026.
Hungary: Act LXIX of 2024 on Cybersecurity enters into force
The NIS 2 Directive (EU) 2022/2555 is transposed in Hungary by Act LXIX of 2024 on the Cybersecurity of Hungary (2024. evi LXIX. torveny), adopted by Parliament on 20 December 2024 and in force from 1 January 2025. It replaces the earlier partial transposition (Act XXIII of 2023) and consolidates Hungary's cybersecurity regime into one framework supervised by the SZTFH.
Slovakia: Act 366/2024 Z.z. amending the Cybersecurity Act (NIS 2 transposition) enters into force
The NIS 2 Directive (EU) 2022/2555 is transposed in Slovakia by Act 366/2024 Z.z., amending Act 69/2018 Z.z. on cybersecurity (zakon o kybernetickej bezpecnosti), in force from 1 January 2025. It expands the scope of regulated entities and assigns supervision to the National Security Authority (NBU).
2024
Greece transposes NIS 2 with Law 5160/2024
The NIS 2 Directive (EU) 2022/2555 was transposed into Greek law by Law 5160/2024, published in Government Gazette FEK A' 195 of 27 November 2024 and in force from that date. The law reorganises the national cybersecurity framework under the National Cyber Security Authority and expands the population of essential and important entities.
CIR 2024/2690 enters into force
The Commission Implementing Regulation becomes binding across all EU member states 20 days after publication, establishing the technical baseline for NIS2 compliance.
CIR 2024/2690 published: NIS2 technical requirements regulation
Commission Implementing Regulation (EU) 2024/2690 published, specifying technical and methodological requirements for NIS2 cybersecurity risk management measures for digital infrastructure and service providers.
Belgium: Law of 26 April 2024 (NIS 2) enters into force
Belgium meets the EU deadline. The Loi du 26 avril 2024 (published Moniteur belge 17 May 2024) enters into force on 18 October 2024. CCB runs Safeonweb@Work as the national registration portal; CERT.be sits inside CCB.
Lithuania: amended Cybersecurity Law (NIS 2 transposition) enters into force
The NIS 2 Directive (EU) 2022/2555 is transposed in Lithuania by the Law on Cyber Security (Kibernetinio saugumo istatymas, No. XII-1428 as amended by Law XIV-2902), adopted on 11 July 2024 and in force from 18 October 2024.
NIS2 transposition deadline expires: most member states miss it
Member states were required to transpose NIS2 into national law by this date. Most, including Germany, miss the deadline. Only Belgium has fully transposed and begun enforcement.
Italy adopts Decreto Legislativo n. 138/2024 (NIS 2 transposition)
Italy becomes one of the first Member States to formally transpose NIS 2. D.Lgs. 138/2024 of 4 September 2024, published in the Gazzetta Ufficiale on 1 October 2024, establishes ACN (Agenzia per la Cybersicurezza Nazionale) as the sole competent authority and hosts CSIRT Italia. Enters into force 16 October 2024.
Latvia: National Cybersecurity Law (NIS 2 transposition) enters into force
The NIS 2 Directive (EU) 2022/2555 is transposed in Latvia by the National Cybersecurity Law (Nacionalas kiberdrosibas likums), adopted by the Saeima on 20 June 2024, published in Latvijas Vestnesis on 4 July 2024, and in force from 1 September 2024.
Croatia: Zakon o kibernetickoj sigurnosti (NIS 2 transposition) enters into force
Croatia transposes the NIS 2 Directive (EU) 2022/2555. The Cybersecurity Act (Zakon o kibernetickoj sigurnosti), published in Narodne novine 14/2024, enters into force on 15 February 2024, making Croatia one of the earliest Member States to transpose. It defines essential and important entities and assigns supervision under the national cybersecurity framework.
2023
IT-Grundschutz Kompendium Edition 2023 released
BSI publishes the IT-Grundschutz Kompendium Edition 2023, the current production standard for information security management in Germany. Remains the valid audit reference through the Grundschutz++ transition.
NIS2 Directive enters into force
The NIS2 Directive enters into force 20 days after publication. Member states have until October 17, 2024 to transpose it into national law.
2022
NIS2 Directive published in Official Journal
Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union published in the Official Journal of the European Union.
Sources
80
This page is regularly updated from the following official and journalistic sources.
Sources
- BSI Act (BSIG) §§ 32, 33, 38, 39, 61, gesetze-im-internet.de/bsig_2025
- NIS2UmsuCG, BGBl. 2025 I no. 301
- Directive (EU) 2022/2555 (NIS 2), Art. 3, 40, 41, 45, EUR-Lex
- Explanatory memorandum to the NIS2UmsuCG, Bundestag printed paper 21/1501, p. 154 (on § 38(3))
What the walkthrough costs
€4,800 net a year, plus VAT
30 days money backBy invoice, due in 30 days. Cancel within the first 30 days: invoice cancelled or money back.
Guided NIS 2 implementation, step by step
A history of changes and sign-offs to show your regulator
Deadlines and reminders for each requirement
Security questionnaire for your suppliers
Export to PDF or CSV at any time
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
